AWS Builder Center

Builder Center

Neighbourlink: a live disaster-safety map for India, with authorization in Cedar

Neighbourlink is a community hazard and emergency map for India. It combines live public disaster data, reports from neighbours, and a privacy-first SOS system on one 3D map. We built it for the WeMakeDevs × AWS hackathon.

Ritu Raj

When a flood hits your street, the official map doesn’t know yet

During the monsoon, the gap between “it’s raining” and “my lane is waist-deep” is measured in minutes. Official warnings cover districts, not streets, and people stuck in water need help faster than a phone tree can manage.
Neighbourlink is a community hazard and emergency map for India. It combines live public disaster data, reports from neighbours, and a privacy-first SOS system on one 3D map. We built it for the WeMakeDevs × AWS hackathon.

What it does

Live disaster data for all of India, and the world. Neighbourlink pulls real events with no API keys:
  • Earthquakes from USGS: M2.5 and up in and around India, M5 and up worldwide.
  • Disaster alerts from GDACS (UN/EU): cyclone, flood and drought alerts for India, plus Orange and Red alerts worldwide.
Each event is tagged India, Near India or World and sorted so active Indian events come first.
“Conditions here” for any city:
  • Live weather from Open-Meteo.
  • Air quality on India’s own National AQI scale. We calculate it the way CPCB does, from 24-hour PM2.5 and PM10 averages, so the categories (Good to Severe) match what people already know. Outside India we use the US EPA AQI.
  • A live flood-risk estimate. A transparent rule engine takes real rainfall for the past and next 24 hours, IMD’s heavy (64.5 mm) and very heavy (115.6 mm) thresholds, and modelled river discharge from GloFAS compared with its seasonal median. If an essential input is missing, it says “Insufficient data” instead of guessing “safe”.
Community reports that need independent confirmation. Residents report waterlogging, fallen trees or landslides, with photos. Location metadata is stripped from photos on the device before upload. A report only becomes community-corroborated when someone other than the reporter confirms it. Disputes flag a report for review but never delete it.
SOS that protects the person asking for help. The public sees a blurred ~1 km area and no phone number. Verified responders see the exact location and callback number, and can acknowledge, post updates and resolve. The requester follows the status live.
3D walk mode with real-time weather and multiplayer.
  • Walk the city in 3D: pick a city or use GPS, and walk a 3D character through the streets with arrow keys or the on-screen pad.
  • The weather is real: it’s fetched for the spot you’re standing on as you move. Rain falls in the real wind direction, fog thickens toward the horizon, and smog appears when air quality is poor; your character puts on a raincoat, opens an umbrella or wears a mask.
  • Others walk with you: everyone online appears live, as Snap Map-style avatars on the normal map and as 3D characters in walk mode.
  • Ask for help nearby: press 🆘 and anyone within 3 km gets an alert with your distance and direction, and a button to turn toward you.

How we use AWS open source: Cedar for every permission decision

A safety app is mostly about who may see and do what. Our first version had role checks scattered through the services, and that’s how bugs slip in. Someone could corroborate their own report, and anyone could publish an “official” warning.
We moved every permission decision to  Cedar , AWS’s open-source authorization language. It runs inside our Next.js server through  @cedar-policy/cedar-wasm , with no AWS account needed. The rules now live in one file that both judges and teammates can read:
Plain text
// Exact SOS locations are for verified responders...
permit (principal, action == Action::"ViewExactLocation", resource is SOSRequest)
when { principal.role == "RESPONDER" || principal.role == "ADMIN" };

// ...and for the person who asked for help.
permit (principal, action == Action::"ViewExactLocation", resource is SOSRequest)
when { resource.requester == principal };

// Corroboration must be independent.
forbid (principal, action == Action::"CorroborateIncident", resource is Incident)
when { resource.reporter == principal };
What we liked:
  • Default deny, and  forbid  always wins. Exceptions like “never your own report” can’t be undone by a broader  permit  someone adds later.
  • The deciding policy is reported back. Cedar tells us which policy decided, so a denied corroboration names  no-self-corroboration , and we turn that into a clear message for the user.
  • It fails closed. Our wrapper treats any evaluation error as a deny.
  • The rules are testable. Ten unit tests cover every rule, and our existing SOS privacy tests pass unchanged after the switch.

Architecture

  • Frontend: Next.js 16, React 19 and MapLibre GL. three.js draws the walk-mode characters directly inside the map’s 3D scene.
  • Live data: server-side adapters for USGS, GDACS and Open-Meteo (weather, air quality, flood, geocoding). They cache results, and if one feed fails the others keep working.
  • Multiplayer: a presence API plus a Server-Sent Events stream of everyone online, sent several times a second.
  • Auth and data: Google sign-in through Supabase, with Prisma as the data layer.
  • Authorization: Cedar (src/authz/policies.ts).
  • Hosting: Vercel and Supabase.

What we learned

  • “No data” must never look like “safe”. The flood engine refuses to estimate without rainfall inputs, and the app says so.
  • Locality matters. Indian users know CPCB’s AQI categories, not the US ones. IMD’s rainfall thresholds mean more here than generic ones.
  • Put authorization in one place early. Moving to Cedar exposed two real gaps that scattered  if  checks had hidden.
  • Privacy is a feature. Ghost mode is the default for live location, SOS locations are blurred for the public, and photo location data is stripped before upload.

What’s next

  • Keep presence in a shared store so multiplayer works across many server instances.
  • Add official IMD and state disaster-authority feeds as they become available.
  • Offer Hindi and Bengali interfaces.
  • Move hosting to AWS (App Runner, with Cognito for sign-in).
Try it: [live demo link] · Code:  github.com/asry16/Neighbourlink 
# open-source# security# hackathon# web-development# community
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article